Redaction that actually works

Every few years a redacted document makes the news for the wrong reason: someone selects the blacked-out passage, presses Ctrl+C, and pastes out the text that was supposed to be hidden. It has happened to law firms, government departments, intelligence agencies and companies filing court documents. The people involved were not careless in any obvious way. They drew a black box over the sensitive text, saw a black box, and reasonably concluded the text was gone. The text was still in the file, and understanding why takes about two minutes.

A PDF page is a stack of instructions, not a picture

When you look at a PDF page you see a finished image, which makes it natural to think of the file as containing that image. Instead it holds an ordered list of drawing instructions: put this text in this font at these coordinates, fill this rectangle with this colour, place this image here. Your reader executes the list from top to bottom, and what you see is the result.

Drawing a black rectangle over a name appends one more instruction to the end of that list. The instruction that draws the name is still there, earlier in the sequence, entirely intact. The rectangle is painted over the top of it, exactly as a sticker covers writing on a page. And just as with a sticker, the writing underneath has not been altered in any way.

Selecting text doesn't work through the picture; it works through the text instructions. Your reader knows there are characters at those coordinates because the file says so, and it will happily hand them to you regardless of what colour has been painted on top. Copy and paste, run text extraction, or open the file in almost any editor, and the name comes straight back out.

The ways this goes wrong

The black rectangle is the famous failure, but it has relatives, and several are easier to fall into:

• Highlighting in black. A black highlight annotation is even weaker than a drawn rectangle: it's an annotation object, and some readers will let you simply select and delete it.
• White text on white. Occasionally used to "remove" a paragraph. It's fully selectable, fully searchable, and appears instantly if anyone changes the background colour.
• Cropping. Cropping a page usually changes which part of it is displayed, not what it contains. The cropped-away content is still in the file, and un-cropping restores it.
• Deleting a page in an editor that saves incrementally. Some applications append changes rather than rewriting the file, so the "deleted" page remains recoverable earlier in the document.
• Redacting the page but not the metadata. The document's title, author and keywords are stored separately and survive everything you do to the pages. So do attachments, annotation authors, and the original filename in some workflows.

There's also a subtler one worth knowing about if you produce documents in volume: a scanned page that has been through OCR carries an invisible text layer sitting behind the image. Black-box the image and the recognised text underneath is untouched, and copy-and-paste reads that layer rather than the picture.

What real redaction does

Whatever the method, the requirement is the same: the sensitive content must not be in the output file. Any black rectangle you see afterwards is there to tell a reader that something was removed; it's a visual convention, not the mechanism. That's the reliable test of whether a tool redacts or merely covers: if drawing the black box is the feature, it's covering.

Two approaches satisfy the requirement. The surgical one edits the page's drawing instructions, deleting the ones that render the sensitive text and writing out a new file. It has the advantage of leaving the rest of the page as live text, and the disadvantage of being intricate: text is often drawn in runs that don't align neatly with the words you want gone, and a tool that gets the boundaries slightly wrong leaves fragments behind.

The other approach rebuilds the page as an image. The page is rendered, the marked regions are painted out in the rendering, and the result replaces the original page entirely. Neither the text, an invisible OCR layer, nor a partially-overlapping run survives, because the page's instructions are discarded wholesale and a bitmap takes their place. It's the more forceful of the two approaches, and the harder to get subtly wrong.

Sleek PDF's redaction tool takes the second route. The trade is stated up front: a redacted page stops being selectable text and becomes a picture of itself. Pages you didn't mark are left untouched, so a hundred-page document with one redaction keeps ninety-nine pages of searchable text. For the documents where redaction failures make the news, giving up searchability on one page in exchange for certainty is an easy decision.

For scanned pages there's no choice to make: the sensitive content is part of an image, so redaction must alter the pixels and rebuild the page from the altered version. A tool that leaves the original image intact and draws over it has not redacted the page.

Checking a document you have already redacted

You don't have to take anyone's word for it, including ours. Before a redacted document leaves your hands, spend a minute on this:

1. Try to select it. Open the file, drag across the black area, and copy. Paste into a text editor. If anything appears, the redaction failed.
2. Search for it. Press Ctrl+F and search for a redacted name or number. A hit inside a blacked-out region is a failure, and this catches cases where selection is awkward but the text is present.
3. Extract everything. The thorough version: run the file through text extraction and read the output. This surfaces text that's present but not easily selectable, including invisible OCR layers.
4. Check what else is in the file. Metadata, attachments, annotation authors and document history are separate from the page content. The privacy scanner reports all of them in one pass, and stripping metadata handles the most common leak.

A workflow that holds up

For anything consequential (court filings, FOI responses, documents going to a counterparty), the order matters:

1. Keep an unredacted master, filed somewhere clearly marked. Redaction is irreversible by design, and you will need the original again.
2. Redact the page content, removing rather than covering.
3. Strip metadata and check for attachments. This step is skipped most often, and it is what identifies the author of an anonymous document.
4. Verify with select, search and extract on the finished file, meaning the copy you are about to send.
5. Send that exact file. Don't re-save it through another application on the way out; a round trip through an editor can reintroduce history you just removed.

Make a habit of verifying the copy that actually leaves, opened fresh, rather than the editor window you have been working in. Pasting into a text editor would have caught nearly every published redaction failure.